JIRA Azure Active Directory SSO for JIRA - Forze Azure Login

Mart Lehtmets February 17, 2021

Hello dear community

We are struggling with JIRA Azure Active Directory SSO for JIRA.

We used this official Tutorial to set it up.

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/jiramicrosoft-tutorial

Everything works good. Users can log in through AzureAD.

BUT

We are having problem, when we turn on "Force Azure Login" setting in this JIRA SSO app in configurations.

When we turn it on and then go to JIRA url, then we will be redirected to AzureAD log in page, which is good. We can log in succesfully, but when Administrator tries to go from Administration menu item for example to "Manage apps" page, then it shows for a split second that login is redirected to AzureAD, but then redirected back to Home Dashboard. 

It's quite a problem since Adminsitrators can not access administration part when "Force Azure login" setting is turned on,.

We haven't figured out how we can fix that?! Anyone knows a solution for this problem?

 

4 answers

1 accepted

2 votes
Answer accepted
Lokesh Naktode_miniOrange
Atlassian Partner
February 18, 2021

Hi @Mart Lehtmets ,

In SAML SSO, IDP just sends the SAML Response and it is the responsibility of the SAML SSO plugin to create a user session (end-user session and WebSudo session) and it seems like you are using Microsoft's JIRA SAML SSO plugin, I suggest you check for an update or submit a support request to Microsoft for faster troubleshooting.

You can also take a look at the third-party plugins available on the Atlassian Marketplace which provides advanced features and updates directly from the Atlassian Marketplace.

Here is one of the SAML SSO plugins from miniOrange. It has a lot of advanced features that allow SSO to end-users as well as the JIRA Admin console. It also has an emergency URL to bypass SSO and allow login using the local JIRA credential and this URL can be configured in such way so that only administrator can use in case of emergency.

Thanks,

Lokesh 

PS: I work for miniOrange one of the top SSO vendors in the Atlassian Marketplace. Feel free to reach out to miniOrange Support in case of any questions or need assistance with the plugin configuration.

Mart Lehtmets March 23, 2021

Thank you for the recommendation. We went for the miniOrange one and it works like we need to. We can force Azure Login and admin portal works as well.

Simon Leclercq
Contributor
August 19, 2021

the problem is this miniOrange addon is not free ! 

SAML SSO by Microsoft is free but is not working for the admin portal

Mart Lehtmets August 19, 2021

Thats was the whole reason why we ended up paying for the miniOrange add-on!

If Microsoft would put a little more effort into its add-on, we would be glad to switch back to it.

Fernando Passos
Contributor
September 24, 2021

Hi @Lokesh Naktode_miniOrange I'm running a test on the plugin that you recommended and a question arose, how to remove the jira's default login screen and leave only the SSO redirect screen? Thank you.image.png

Shweta Vispute
Contributor
September 24, 2021

Hello,

This can be achieved by disabling the Delay Auto-Redirection to IDP option from the Sign In Settings tab of the plugin.

img.png

PS: I am a developer at miniOrange, a Top Atlassian SSO Vendor!   

If you have any questions about it or would like to discuss it further, you can reach out to info@xecurify.com.

I hope this helps you!

Thanks,

Shweta.

Like # people like this
2 votes
Simon Leclercq
Contributor
August 19, 2021

Here is the solution for those searching for it : i found it here : https://confluence.atlassian.com/adminjiraserver/configuring-secure-administrator-sessions-938847890.html

 

Disabling secure administrator sessions
Secure administrator sessions (i.e. password confirmation before accessing administration functions) are enabled by default. If this causes issues for your Jira instance (e.g. if you are using a custom authentication mechanism), you can disable this feature by specifying the following line in your jira-config.properties file:

jira.websudo.is.disabled = true

0 votes
Simon Leclercq
Contributor
August 19, 2021

Have you find a way to fix this or you ended up to pay for using another plugin ?

Mart Lehtmets August 19, 2021

We ended up using miniOrange plugin. Works like a charm.

Simon Leclercq
Contributor
August 19, 2021

Thanks for the head up, good to know, sadly this orange plugin is not free. I gave the solution below

0 votes
Pramodh M
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
February 17, 2021

Hi @Mart Lehtmets 

I guess the token is missing the second time when it asks for authentication.

The solution here is to disable "Force Azure login" and have your primary authentication as SAML SSO, instead if you are using any other directory.

You may want to check the settings in SSO App you are configuring in Jira.

Now to troubleshoot the redirection problem, please see one of the links in the KB

Please analyze the logs in Jira.

https://confluence.atlassian.com/crowdkb/redirected-to-the-login-screen-with-no-errors-when-attempting-to-log-in-to-any-atlassian-applications-376834420.html

Thanks,
Pramodh

Suggest an answer

Log in or Sign up to answer